From 53bd4df6f142c240d7beaa6b6789839da1f5f164 Mon Sep 17 00:00:00 2001
From: "justdave%bugzilla.org" <>
Date: Mon, 25 Oct 2004 14:25:58 +0000
Subject: [PATCH] [SECURITY] Bug 263780: Exporting a bug to XML exposes user
 comments and attachment summaries which are marked as private to users who
 are not members of the group allowed to see private comments and attachments.
  XML export is not exposed in the user interface, but is available to anyone
 who knows the correct URL to invoke it.  This only affects sites that use the
 'insidergroup' feature. Patch by Joel Peshkin <bugreport@peshkin.net>
 r=vladd,justdave, a=justdave

---
 show_bug.cgi                          | 4 ++++
 template/en/default/bug/show.xml.tmpl | 2 ++
 2 files changed, 6 insertions(+)

diff --git a/show_bug.cgi b/show_bug.cgi
index 4803ff67bd..03cf6f60d5 100755
--- a/show_bug.cgi
+++ b/show_bug.cgi
@@ -113,6 +113,10 @@ if ($cgi->param("field")) {
     @fieldlist = $cgi->param("field");
 }
 
+unless (UserInGroup(Param("timetrackinggroup"))) {
+    @fieldlist = grep($_ !~ /_time$/, @fieldlist);
+}
+
 foreach (@fieldlist) {
     $displayfields{$_} = 1;
 }
diff --git a/template/en/default/bug/show.xml.tmpl b/template/en/default/bug/show.xml.tmpl
index 97d3dee675..37cead53da 100644
--- a/template/en/default/bug/show.xml.tmpl
+++ b/template/en/default/bug/show.xml.tmpl
@@ -53,6 +53,7 @@
 
       [% IF displayfields.long_desc %]
         [% FOREACH c = bug.longdescs %]
+          [% NEXT IF c.isprivate && !UserInGroup(Param("insidergroup")) %]
           <long_desc>
             <who>[% c.email FILTER xml %]</who>
             <bug_when>[% c.time FILTER time FILTER xml %]</bug_when>
@@ -63,6 +64,7 @@
       
       [% IF displayfields.attachment %]
         [% FOREACH a = bug.attachments %]
+          [% NEXT IF a.isprivate && !UserInGroup(Param("insidergroup")) %]
           <attachment>
             <attachid>[% a.attachid %]</attachid>
             <date>[% a.date FILTER time FILTER xml %]</date>
-- 
2.47.2